“What part of JMP RSP don’t you understand?” - Assembly Language Bootcamp for Malware Analysis

Session Outline

Assembly Language - Basics

• Instructions

• OpCodes

• Registers (EFLAGS)

Writing Assembly code - 60 mins

• Environment Setup

• SASM

• Code examples - building applications in SASM

Labs 1

Lab 1.0 - Environment Setup

Lab 1.2 - SASM Setup

Lab 1.3 - Coding

Reading Assembly code

• Code examples

• Applications

Labs 2

Lab 2.0 - Reading Assembly Code Part 1

Lab 2.1 - Reading Assembly Code Part 2

Real-world Malware

• Binary Analysis - Static

• Binary Analysis - Dynamic

Labs 3

Lab 3.0 - Static Analysis

Lab 3.1 - Dynamic Analysis

Lab 3.2 - Putting it all together